hxxp://9ps[.]ru/JbMcnp

Analysis

max time kernel
131s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://9ps.ru/JbMcnp

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
4884	msedge.exe
4884	msedge.exe
3148	msedge.exe
3148	msedge.exe
2644	identity_helper.exe
2644	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4584	4884	msedge.exe	77
PID 4884 wrote to memory of 4584	4884	msedge.exe	77
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 4908	4884	msedge.exe	78
PID 4884 wrote to memory of 1092	4884	msedge.exe	79
PID 4884 wrote to memory of 1092	4884	msedge.exe	79
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80
PID 4884 wrote to memory of 4404	4884	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://9ps.ru/JbMcnp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc20b3cb8,0x7ffdc20b3cc8,0x7ffdc20b3cd8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,2877307595706268796,3396438811374061471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
43KB

MD5
7f2c172ca810d85c0596390b4ab21df3

SHA1
d4acb412e626e744609aa326247bd7eeec469bec

SHA256
4ccac6b00b8d6b7bec9886d8a23d84131bed955d995a37b5017196b03d1edab6

SHA512
961fd847cdc7b7c54dcb5ec19e3446701de454e9d06e1e2025360a1d0b426d204fb8aec90b854c7b2dbe3153aa66b5d90ba56f8ac6a8bc996177642d6f55c263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
82065f0599842740817ea60226f61900

SHA1
3a849d26053ce81dcd16791b3ae6e763ca005b4f

SHA256
5d8d692f1b4a9ff9f6d8aef1b010a53e3e0dabeb3ffb3dfb7543ce5425ba5090

SHA512
4619118b2acc8edfcfb972bc58d4ae01520332ca0c3e7db36b039c03895941357b1727407345542e2b1e492fab812cf925e52d9fc662549d31faf24d5359769f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
c7daf6e3eafee010fecbd4a4b21f5212

SHA1
e12d833d6e5b8e9aa9a71dfed6acf28c8340105e

SHA256
2195b8143ca0b95aa7f1a12b3bde377a6fb94ee64ae6f05a1973619c3d54a235

SHA512
204bfe62604e376a083c6b8d2eca4c33c22573f09f025826fd8975e8cf36bea3709c68ff4f1b853b99a6b8136cf75abcca903b6171c5c8d271e842e1cdb83de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
69e0530fab7c4f3b0319330c51115838

SHA1
8344d780c68a0fce914ebe2a3740716933786e31

SHA256
78fa1b708a95f4b403c6a08a13ac10f35a10bf3f570144ee8c729fa642a0605c

SHA512
70d63d18c2ceb6ac6b232515c47fa2c93f85802cb67f0ff5ee6b3832ad13617c2c4c6f27725943f75413d3ca2597ea2c1fcc327836ea7f9d4fb947b8699536da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bf43f0e260b7c07b4e335d4aecc37d81

SHA1
3f613a8b336c07e21034be0055684fec44e90732

SHA256
c824a914d99b5bcc754bab10c944a6cf2bdb86a2c811c070d0d77664444e949e

SHA512
4f93ea29b31ece6efaab1bbd93b92c313654a653471bd3b117203fc9c4d39d5ea178fc699f1afe3f43b5560a0d735ea5945e00daea1f84889c97a483dd5eae98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1cc77f1aee0ba9139cc6e12ea7908f4

SHA1
e06131feddb2afb870d736a449f32d177b71ea99

SHA256
8a12db7859d81d898e0701452d27f6b365804e533a856607595e8eeeaa0fd797

SHA512
10196bc8537bee7219c43b73f773e0f63fde85517ca818f3736d982abea8ffa253557ef42c80b68468b3725499a5e405d23876b7a99ba6731253301e997b6be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40b4ef876d953982d8d7397c2d974fc7

SHA1
3147f1c049b3d8782177c855705cf8d28e635b31

SHA256
e5b07996da337861ec41fd2856d72484f58ee7872652689f5c8bcb598d74e6bc

SHA512
491c14a5ee6b108db62ccb8c058d3b30084d03b5d36c0e1800002f87cb797afe6f40a82496fdd21bb28762cb0dbd22774216dd27d7c8980dd9796c94c4b18ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e9578c93d6ad77e9f7f55b6f9f31127

SHA1
e2a520f64d8c979b3660df91dfb14d1c20f84bda

SHA256
7790e6147920d8c4225b52d4574b0b1b40e51137ffb254ceff3ec86fe1014d3f

SHA512
3f5500ba4a8fc0618b9c873e97707f30ce8b3d662b25fc0a399eb546c28f9b786073a8d37d48261dd801ee73a14106217f89f996435b23038dc41953c21ec8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f543908958dd1e50cbca36c1c54b2011

SHA1
6b0de3993d0c0e6768be4d992592a195131ce61e

SHA256
1d01c46a3b5ba3cd6fc277cb09f707e129368a6e6b1df1dab658a7e4ed5ddd04

SHA512
5d62930d32e316ae6fba2872f0db57fa15af20f9eed08decfb3ffa3660f90ae62b61d47956396fdaae9297158d504f6111c2173e89fd4185d1e44318f1db69c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
664d480399c15175b5f72f72109f6657

SHA1
d95042754db773233f777177b7b1e227e0b4ce1c

SHA256
c41bc07dab6cb9cfa6b51f6e94da5160caea54a148d7582c78513f9939a0fb14

SHA512
1a86587f88794de098d957e77aa389771a5b4afa8bd53cbe851e4583b280d035e5036966cfc169f8d6f5ec13f33038ceb2e606461f0d2f0cbe40e51aa7a08543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0b7254da15b948213d565b1a83bb78b

SHA1
cde13b7a1c3644f283cb0e373054c8008b2bf9f1

SHA256
fb4aadf42b49b2ff5b19a9d077cd6b162a09a925e9bba70a682646a03485a41a

SHA512
7427a5c8941447f86f502cd6c37075ec723a6a19916a8e65410931056ba59e2a72987f371f2258d2054f776f4d73ac0867cbbe1a42a95c0c38d107e6069dfdc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39afae7cddf71bccb33790b890f88285

SHA1
e545fe027a059830a1061668a1cf932471d91ce6

SHA256
849dd929968b7d3dd3f21de628e794e18c17852ad6a193d0ce85bcd9d1cffe72

SHA512
1065344575b1b20c7e728771687abb557ca712de7b7a22c0e265ddfaac004507270db319c7ec09eeef27b61f0e3c465e9414fd0520afa55cc521791e7342fe47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
223482346cde98b314a22729cc181111

SHA1
7eda7729b4ff10e39d208c5ad9d380920db4f783

SHA256
f8a067532506bc43c99a5103d9afc6886f3f1116e69505a9906dd590d3e3f362

SHA512
fbb8073df66de6a365ade9def426f0dbfe21ac2148ec7594636710d9e8e263d1873090ce8643759d46ab6b5dd4a2c3ab2f15caeaab9ddd1827e5876e6cc7962f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594be4.TMP

Filesize
1KB

MD5
f7bd9d6b04bc9a6704359e20bf1661f3

SHA1
edfde99c7670f9e9f26402d9bd5fb40bbb0c92e9

SHA256
c715aeab25f79d4b20ce6931188fd9cfc17f71dad281ec78c09ab1b0a6e6ddc8

SHA512
480d4f353c9b6224370b9c66ac438151c332b1e225145a983ba89630f56d1b6024210a6eed5c43de1cd04fcd3ea020a1466a11ea44151dc93776a209984966fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fb2426c0282c977e5a9f0bc406f61113

SHA1
f73c09f6d29e9c5bdd0aa635337593bbc283e238

SHA256
640589a500c728f97857237266c10a487680556218c0366e314826bef547ba30

SHA512
ffed4411221c44424dcf7b0c1f932f85321d261f54ce74f6dd1f18c88e13bf1fb48f5e6158c883de932d3332628846c950480c3c437164ea6aa2c4dcd3f00f72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit